Analytics BIOC High
✕

A successful SSO sign-in from TOR

A successful sign-in from a TOR exit node.

Module:
Identity Analytics
Data source:
AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Initial Access (TA0001) Command and Control (TA0011)
ATT&CK techniques: Proxy: Multi-hop Proxy (T1090.003) Valid Accounts (T1078)
Attacker's goals:

Gain initial access to organization and hiding itself.

Investigative actions:

Block all web traffic to and from public Tor entry and exit nodes. Search for additional logins from the same user around the alert timestamp.

Test period:
N/A (single event)
Deduplication:
1 Hour
1 variation:
  • A successful SSO sign-in from TOR via Mobile Device Medium (parent: High)